Executive brief
CubeCart is an e-commerce platform that allows administrators to manage product listings. A vulnerability in versions before 6.7.5 permits authenticated administrators with product-editing permissions to inject malicious JavaScript through product description fields. When customers or other administrators view affected products, the injected code executes in their browsers, potentially exposing session data or enabling unauthorized actions.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the admin/sources/products.index.inc.php file. The vulnerability exists because the application reads rich-text content (description, description_short, and spec_copy fields) from POST data and applies only a basic regex filter that removes <script> tags but fails to strip event-handler attributes (onclick, onload, etc.), SVG content, or javascript: URI schemes. An authenticated administrator with product-editing rights can store payloads using these bypasses; when the stored content is rendered through Smarty templates on the storefront or admin panel, the JavaScript executes. The fix, deployed in version 6.7.5, implements an allowlist HTML sanitizer that strips unsafe content while preserving legitimate formatting. The vulnerability requires admin authentication and product-edit privileges.
Affected products
- CubeCart CubeCart before 6.7.5
Timeline
- 2026-09-17: disclosed
- 2026-06-08: patched: Fix committed before public disclosure